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Abstract 

Intelligent  Control  and  Health  Management  technology  for  aircraft  propulsion  systems  is  much  more  developed  in 
the  laboratory  than  in  practice.  With  a  renewed  emphasis  on  reducing  engine  life  cycle  costs,  improving  fuel 
efficiency,  increasing  durability  and  life,  etc.,  driven  by  various  government  programs,  there  is  a  strong  push  to 
move  these  technologies  out  of  the  laboratory  and  onto  the  engine.  This  paper  describes  the  existing  state  of  engine 
control  and  on-board  health  management,  and  surveys  some  specific  technologies  under  development  that  will 
enable  an  aircraft  propulsion  system  to  operate  in  an  intelligent  way — defined  as  self-diagnostic,  self-prognostic, 
self-optimizing,  and  mission  adaptable.  These  technologies  offer  the  potential  for  creating  extremely  safe,  highly 
reliable  systems.  The  technologies  will  help  to  enable  a  level  of  performance  that  far  exceeds  that  of  today’s 
propulsion  systems  in  terms  of  reduction  of  harmful  emissions,  maximization  of  fuel  efficiency,  and  minimization  of 
noise,  while  improving  system  affordability  and  safety.  Technologies  that  are  discussed  include  various  aspects  of 
propulsion  control,  diagnostics,  prognostics,  and  their  integration.  The  paper  focuses  on  the  improvements  that  can 
be  achieved  through  innovative  software  and  algorithms.  It  concentrates  on  those  areas  that  do  not  require 
significant  advances  in  sensors  and  actuators  to  make  them  achievable,  while  acknowledging  the  additional  benefit 
that  can  be  realized  when  those  technologies  become  available.  The  paper  also  discusses  issues  associated  with  the 
introduction  of  some  of  the  technologies. 


Introduction 

The  intent  of  this  paper  is  to  describe  selected  algorithms  that  enable  the  development  of  an  intelligent  control  for 
aircraft  engines.  Specifically,  it  focuses  on  the  areas  where  improved  performance  and  lower  life  cycle  cost  can  be 
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achieved  through  on-board  software.  These  include  promising  control,  diagnostics  and  prognostics  algorithms,  as 
well  as  their  integration  into  a  coordinated  system.  There  is  some  discussion  of  adding  sensors  for  diagnostics,  as 
well  as  the  prevailing  attitude  concerning  that.  However,  it  is  recognized  that  sensor  technology  will  advance,  and 
the  impact  of  that  fact  must  not  be  discounted.  Still,  the  paper  stays  away  from  discussing  technologies  that  rely  on 
the  development  of  new  sensors,  and  addresses  areas  where  current  sensors  (or  current  types  of  sensors  at  current 
locations)  suffice  for  the  algorithms  to  provide  benefit. 

The  paper  is  organized  as  follows.  The  rest  of  this  section  provides  some  basic  background  on  turbofan  engines, 
along  with  a  brief  overview  of  the  current  control  structure  and  on-board  monitoring  systems — this  may  help  the 
reader  to  understand  the  applications  presented  later.  This  leads  into  a  working  definition  of  Intelligent  Control  for 
turbine  engines.  The  next  section  covers  some  approaches  to  intelligent  control  of  jet  engines.  Following  this  is  a 
section  on  diagnostics,  which  describes  various  systems  and  approaches,  including  a  discussion  of  diagnostic 
sensors.  This  is  followed  by  sections  on  prognostics  and  integration,  and  finally  concluding  remarks. 

Engine  Overview 

A  turbofan  engine  gas  path  consists  of  several  components  arranged  from  front  to  back  of  an  engine  (fig.  1).  The 
first  component  is  the  fan  which  is  open  to  the  outside  and  in  a  commercial  engine  provides  most  of  the  thrust  by 
sending  a  vast  quantity  of  air  around  the  engine  core,  bypassing  the  other  components  (turbomachinery).  The  first  of 
these  remaining  components  is  the  booster,  also  known  as  the  low  pressure  compressor  (LPC),  which  is  followed  by 
the  high  pressure  compressor  (HPC).  This  opens  into  the  combustor  where  fuel  is  injected  and  burned.  The  resulting 
hot  gas  drives  the  high  pressure  turbine  (HPT)  and  the  low  pressure  turbine  (LPT).  Each  of  these  components  affects 
the  engine's  operation,  and  algorithms  for  improved  control  and  knowledge  about  component  health  will  enable  a 
higher  level  of  performance  to  be  obtained.  The  state  of  component  health  involves  characteristics  that  degrade  over 
time:  such  features  as  efficiency,  flow  capacity,  and  seal  leakage.  These  tend  to  change  slowly  over  many  flights, 
but  abrupt  changes  might  indicate  the  occurrence  of  a  sudden  fault. 

From  a  structural  point  of  view,  the  engine  is  made  up  of  rotating  and  non-rotating  parts.  The  non-rotating  outer 
portion  consists  of,  among  other  things,  the  ducts  for  bypass  airflow,  and  stator  vanes  which  project  into  the  airflow 
through  the  components.  It  also  contains  the  bearings  outer  races  that  hold  the  rolling  elements  that  support  the 
shafts.  The  shafts  in  turn  support  the  fan,  compressor,  and  turbine  disks — these  are  the  rotating  components.  The  low 
pressure  shaft  supports  the  fan,  LPC,  and  LPT.  The  hollow  high  pressure  shaft  fits  around  the  low  pressure  shaft  and 
is  separated  from  it  by  bearings;  it  supports  the  HPC  and  HPT.  The  compressors  and  turbines  each  consist  of 
multiple  disks  attached  to  the  shaft,  and  each  disk  is  fitted  with  multiple  blades  around  its  circumference.  As  these 
parts  rotate,  they  interact,  setting  up  natural  vibrations  and  resonances.  Shifts  in  an  engine  vibration  signature  may 
signal  damage. 


Fan 


Compressor 


Turbine 


Nozzle 


Combustor 


Mixer 


Figure  1. — Commercial  turbofan  engine  cross  section  showing  components. 


NASA/TM— 2005-2 1 3622 


2 


Figure  2.—  Block  diagram  of  typical  engine  control  law  architecture. 


Control 

Typical  aircraft  engine  control  systems  maintain  fan  speed  or  engine  pressure  ratio  to  regulate  thrust,  which  is  not 
directly  measurable.  The  controllers  are  generally  based  on  a  variant  of  a  Proportional- Integral  (PI)  scheme, 
combined  with  limit  logic  (fig.  2).  This  limit  logic  consists  of  a  series  of  min  select  and  max  select  blocks,  each  of 
which  selects  a  fuel  flow  rate  command  based  on  various  physical  limits,  acceleration/deceleration  schedules 
(maximum  rotor  speed  rate-of-change  as  a  function  of  rotor  speed),  and  the  current  operating  state  (speed  governor 
loops).  The  final  command  that  exits  the  selection  logic  block  is  integrated  to  produce  a  new  total  fuel  flow.  Thus  an 
increment  of  zero  will  result  in  no  change  in  fuel  flow,  and  a  constant  steady  fuel  flow  will  occur  when  steady  state 
error  is  eliminated. 


Diagnostics 

The  various  on-wing  health  monitoring  systems  of  today,  which  are  a  collection  of  separate,  unrelated 
technologies,  provide  a  basic  level  of  monitoring.  Their  capabilities  are  relatively  limited  and  the  information  they 
provide  is  used  mostly  to  initiate  maintenance  actions,  not  for  real-time  decision-making. 

One  instance  where  the  information  is  used  on  wing  is  for  sensor  validation.  The  controller  has  some  simple  logic 
to  perform  basic  limit  or  rate  of  change  checks  on  engine  sensors  and  actuators.  In  some  cases,  on-board  engine 
models  are  used  in  conjunction  with  the  controller’s  own  sensor  voting  scheme  to  help  determine  which  sensor  is 
correct  when  redundant  sensors  disagree.  The  controller  has  the  additional  responsibility  of  checking  whether  a 
speed  red-line  has  been  exceeded,  and  reducing  fuel  flow  when  it  has. 

Current  engine  vibration  monitoring  systems  sample  at  a  relatively  low  frequency — too  low  to  capture  much 
significant  or  useful  information  on  the  vibratory  modes  of  the  system.  They  check  the  vibration  magnitude  to 
determine  that  it  is  within  a  normal  range.  Magnitudes  that  are  too  high  might  indicate  a  bearing  failure  or  engine 
imbalance,  magnitudes  that  are  too  low  might  indicate  a  faulty  sensor  or  seized  engine. 

Lubrication  system  monitoring  is  performed  using  a  magnetic  chip  detector  to  determine  the  existence  of  ferrous 
debris  in  oil.  This  is  an  indication  of  part  wear. 

Life  cycle  counts  are  performed  on-wing.  Engine  parts,  especially  those  in  the  hot  section,  may  experience  a 
maximum  number  of  severe  thermal  transients  before  they  must  be  retired.  Each  time  the  engine  goes  through  a 
start-up  transient,  the  life  cycle  count  for  each  of  the  critical  components  is  incremented.  This  way,  part  life  is 
tracked  as  a  function  of  use  to  facilitate  scheduled  maintenance. 

Intelligent  Control 

While  these  traditional  control  and  diagnostic  techniques  are  time-tested  and  reliable,  modern  control  techniques 
promise  to  provide  improved  control  and  therefore  improved  aircraft  propulsion  system  performance.  There  is  little 
on-board  today  that  could  be  considered  "intelligent.”  Even  with  all  of  the  advances  in  modeling  and  algorithms, 
implemented  control  and  health  management  schemes  still  maintain  safety  margins  in  terms  of  worst-case  stack  up 
of  uncertainties;  they  still  consider  life  usage  in  terms  of  idealized  flight  cycles;  and  there  is  essentially  no 
accommodation  beyond  simple  predetermined  responses  to  specific  detected  faults.  The  engines  of  today  are  reliable 
and  safe,  but  they  are  expensive  to  operate  and  maintain.  With  the  integration  of  available  models  and  algorithms  for 
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Figure  3. — An  example  of  an  intelligent  control  framework  for  the  SSME. 


on-board  operation  and  the  resultant  increase  in  on-board  intelligence,  engines  of  the  future  will  be  able  to  operate 
even  more  safely  and  reliably  with  reduced  life  cycle  cost. 

The  concept  of  an  intelligent  control  system  that  is  self-aware  and  modifies  itself  in  response  to  changes  in  itself 
or  its  environment  is  well  established.1,2  The  vision  of  an  intelligent  engine  control  that  combined  control  and  health 
management  was  first  conceived  for  reusable  rocket  engines,  in  particular  the  space  shuttle  main  engine  (SSME).3 
The  impetus  for  this  was  that  the  SSME  was  not  as  durable  as  had  been  expected  and  that  it  might  benefit  from  the 
experience  gained  in  the  air  breathing  arena.  Control  complexity  for  air  breathing  engines  had  increased  over  the 
years,  to  the  point  where  it  had  surpassed  that  of  the  SSME,  yet  the  SSME  was  a  more  complex  machine  operating 
in  a  significantly  harsher  environment;  thus  there  was  a  clear  justification  to  increase  its  level  of^intelligence.”  The 
framework  proposed  in  reference  3  for  the  intelligent  control  consisted  of  “a  hierarchy  of  various  control  and 
diagnostic  functionalities.  These  functionalities  include  life-extending  control,  adaptive  control,  real-time  engine 
diagnostics  and  prognostics,  component  condition  monitoring,  real-time  identification,  and  sensor/actuator  fault 
tolerance.  Artificial  intelligence  techniques  [would]  be  considered  for  implementing  coordination,  diagnostics, 
prognostics,  and  reconfiguration  functionalities.”  An  example  of  an  intelligent  control  framework  for  the  SSME  that 
was  demonstrated  in  simulation  is  shown  in  figure  3  (ref.  4).  Conceptually,  both  the  above  description  and  the  figure 
could  apply  equally  well  to  an  intelligent  control  system  for  an  air  breathing  engine.  The  goal  of  such  an  intelligent 
system  is  to  increase  the  level  of  autonomy  of  the  engine  enough  that  it  becomes  self-diagnostic,  self-prognostic, 
self-optimizing,  and  mission  adaptable.  This  means  that  it  can  diagnose  and  recover  from  faults,  it  can  anticipate  and 
avoid  or  at  least  minimize  the  impact  of  faults,  and  it  can  alter  either  its  performance  or  its  goals  to  increase  the 
likelihood  of  successfully  completing  the  overall  mission  even  with  degraded  capability. 

The  current  idea  of  intelligent  control  and  health  management  of  jet  engines  is  essentially  the  same  as  the  original 
concept  for  the  SSME;  the  functionality  of  the  framework  is  just  as  valid  today  as  it  was  then.  In  general  terms,  the 
intelligent  control  framework  consists  of  a  hierarchical  structure:  the  lower  levels  operate  on  a  shorter  time  scale 
performing  duties  that  are  algorithmic  in  nature  requiring  less  intelligence,  while  the  upper  levels  operate  on  a 
longer  time  scale  utilizing  broad  intelligence.^  In  the  engine  application,  viewed  in  the  larger  context  of  the  vehicle, 
the  lowest  level  performs  direct  control,  with  the  basic  diagnostic  functions  above  that.  The  results  of  the  diagnostic 
system  are  fed  to  an  Engine  Level  Coordinator  which  evaluates  the  engine’s  ability  to  carry  out  its  mission.6  In  a 
multi-engine  vehicle,  the  Engine  Level  Coordinator  communicates  with  a  Propulsion  Level  Control  responsible  for 
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distributing  the  propulsion  tasks  among  the  various  engines.7  The  Propulsion  Level  Control  in  turn  communicates 
with  a  Mission  Level  Control  that  evaluates  the  feasibility  of  attempting  to  complete  the  mission  given  the  condition 
of  the  engines  and  vehicle,  and  perhaps  replans  the  mission  to  increase  the  probability  of  success.8  Note  that  the 
Mission  Level  Control  might  also  have  beneath  it  a  structure  similar  to  that  of  the  intelligent  engine  control 
hierarchy,  corresponding  to  the  airframe.  The  algorithms  described  in  this  paper  support  the  levels  below  the  Engine 
Level  Coordinator  in  figure  3. 

Laboratory  research  has  been  carried  out  into  the  different  components  of  an  intelligent  control  system  for  jet 
engines  over  many  years,  mostly  in  simulation.  Occasionally  the  results  of  the  research  are  incorporated  into  a 
product  that  is  used  on-wing,  but  this  is  rare  because  of  the  need  for  a  technology  to  "buy’'  its  way  on  board,  and  a 
general  reluctance  to  add  complexity  as  it  is  perceived  as  reducing  reliability.  Thus  the  irony  of  intelligent  control  is 
demonstrated:  increased  functionality  is  obtained  through  the  addition  of  complexity  and  thus  at  the  expense  of 
reliability — there  must  be  a  net  gain  in  reliability  brought  about  by  the  added  complexity,  and  it  is  precisely  this  that 
has  been  the  impediment  to  the  serious  development  of  an  intelligent  control  system  for  jet  engines. 

This  will  be  changing,  however.  Because  of  new  affordability  goals  for  aircraft  propulsion  systems,  many 
technologies  including  those  related  to  intelligent  control  and  health  management  will  need  to  mature  to  the  point 
where  they  can  be  used.  The  U.S.  Federal  Government  is  sponsoring  a  significant  amount  of  the  work  in  these  areas 
with  the  majority  of  the  research  being  driven  by  several  government  programs  that  advance  various  goals  for 
commercial  and  military  engines.  The  Versatile  Affordable  Advanced  Turbine  Engines  (VAATE)  program  is  a  joint 
Department  of  Defense  (DoD),  NASA,  Department  of  Energy  (DOE),  Industry  effort  focused  on  a  1  Ox 
improvement  in  turbine  engine  affordability  by  the  year  2017.  The  VAATE  goals  are  1)  to  maximize  propulsion 
system  affordability  by  reducing  fuel  consumption  and  improving  durability  and  life,  and  by  exploiting  synergies 
between  common  military  and  civil  cores;  and  2)  to  apply  revolutionary  technologies  to  achieve  quantum 
improvement  in  turbine  engine  capability  and  cost.  In  parallel  with  turbine  engine  capability  increases,  VAATE 
places  major  emphasis  on  Research  and  Development  efforts  to  reduce  turbine  engine  development,  production,  and 

.  o  if) 

maintenance  costs.  * 

The  VAATE  plan  includes  many  technology  areas  related  to  Controls  and  Engine  Health  Management.  Utilization 
of  integrated  ground-based  and  on-board  control,  diagnostic,  and  prognostic  systems  will  maximize  engine  time-on- 
wing.  This  will  be  achieved  while  minimizing  support  costs  without  compromising  performance  and  survivability.  It 
will  provide  flexible  health  management  technologies  that  can  be  integrated  into  legacy,  pipeline,  and  future 
propulsion  systems. 

Additionally,  NASA  is  interested  in  intelligent  technologies  to  effect  substantial  reductions  in  emissions  and  noise 
generated  by  commercial  aircraft,  to  improve  the  safety  of  commercial  aircraft,  and  to  increase  the  throughput  of  our 
air  transportation  system.  Specifically,  NASA  goals  are  to  achieve  reductions  in  carbon  dioxide  emissions  by 
20  percent,  to  achieve  reductions  in  nitrogen  oxides  generated  during  take-off  and  landing  by  70  percent,  and  to 
achieve  community  noise  level  reductions  of  20  db  of  effective  perceived  noise.  Safety  and  mobility  goals  are 
similarly  aggressive,  with  metrics  concerning:  1)  reductions  in  the  fatal  accident  rate,  2)  reductions  in  the 
vulnerability  of  the  air  transportation  system  to  hostile  threats,  3)  mitigation  of  the  consequences  of  accidents  and 
hostile  acts,  and  4)  the  enabling  of  more  people  and  goods  to  travel  faster  and  farther  with  fewer  delays.  These  will 
be  met  by  technology  advancements  in  both  airframe  and  propulsion  systems,  including  advancements  in  both 
conventional  and  “intelligent”  technologies. 

Many  of  the  necessary  intelligent  control  system  technologies  lend  themselves  to  life  cycle  cost  (LCC)  reduction. 
Primary  drivers  for  LCC  are  maintenance,  reliability,  and  fuel  consumption.  Reduction  of  all  three  requires  a  smarter 
engine,  one  that  will  provide  real-time,  accurate  diagnostic  and  life  management  status.  To  accomplish  this,  the 
system  must  be  not  only  aware  of  but  responsive  to  its  condition  (i.e.,  temperatures,  efficiency,  and  performance). 

Many  other  technologies  will  be  required  as  well  to  meet  the  goals:  Micro-Electro-Mechanical  Systems  (MEMS), 
light  weight  high  temperature  materials,  sensors  for  harsh  environments,  etc.  Some  of  these  technologies  will  open 
up  opportunities  for  additional  aspects  of  control,  notably  active  control  of  components,"  12  but  it  will  suffice  here 
simply  to  mention  that  fact,  since  we  are  focusing  on  algorithms  that  have  minimal  need  for  the  development  of  new 
supporting  technologies. 


Control 

New  techniques  have  been  developed  that  address  specific  issues  within  the  current  propulsion  control  paradigm, 
and  modem  approaches  to  old  problems  have  been  attempted  in  an  effort  to  meet  the  goals  of  future  engines.  They 
are  not  all  complementary;  some  techniques  are  appropriate  for  several  applications,  which  can  be  a  great  benefit.  In 
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the  following  subsections,  various  applications  are  presented  and  specific  approaches  discussed;  these  go  beyond  the 
current  practice  and  are  relevant  technologies  for  the  future  intelligent  engine. 

Life  Extending  Control 

Engine  controllers  are  designed  to  meet  certain  operability  and  performance  constraints.  Some  are  engine-related, 
such  as  that  the  engine  should  not  stall  on  acceleration;  some  are  externally  imposed,  such  as  the  Federal  Aviation 
Administration’s  (FAA)  rise  time  requirement  for  thrust  in  commercial  engines.  The  rise  time  requirement  results  in 
the  development  of  an  acceleration  schedule  (the  maximum  rotor  speed  rate-of-change  loop  as  a  function  of  rotor 
speed,  sometimes  called  the  Ndot  control  mode)  that  is  designed  simply  to  accelerate  the  fan  and  core  to  achieve 
desired  thrust  within  the  required  time,  while  not  exceeding  other  constraints.  Durability  is  one  of  the  key  VAATE 
goals,  so  it  is  reasonable  that  it  should  be  taken  into  consideration  in  the  design  process  of  future  engine  control 
algorithms.  The  idea  of  Life  Extending  Control  is  to  design  a  control  system  which  provides  acceptable  engine 
response  while  minimizing  component  damage.  The  concept  of  Life  Extending  Control  has  demonstrated  that  by 
using  smart  acceleration  logic  for  engine  control,  the  thermomechanical  fatigue  damage  accumulated  during  a 
typical  engine  acceleration  transient  from  idle  to  full  power  can  be  significantly  decreased  without  any  noticeable 
loss  in  engine  performance.  By  slightly  reducing  the  peak  temperature  during  a  transient,  significant  part  life  can  be 
saved.  A  typical  baseline  acceleration  schedule  for  a  commercial  turbofan  engine,  as  well  as  schedules  optimized  to 
achieve  acceptable  take-off  transients  while  minimizing  life  consumption  for  a  specific  hot  section  engine 
component,  is  shown  in  figure  4.  The  thrust  transients  that  correspond  to  these  schedules  are  shown  in  figure  5. 
Simulation  results  demonstrated  that  the  optimized  acceleration  schedule  decreased  component  life  consumption 
during  takeoff  significantly  for  the  same  rise  time,  and  extending  the  rise  time  slightly  reduced  the  life  consumption 
even  more.13  A  recent  study14  looked  at  several  potential  component  life  extending  technologies,  and  it  showed  that 
smart  acceleration/deceleration  logic  was  the  highest  ranked  software-only  technology  while  active  clearance 
control  was  the  highest  ranked  software/hardware  technology.15 16  One  potential  architecture  that  enables  adjustment 
of  the  schedules  in  response  to  accumulated  engine  damage  is  shown  in  figure  6  (ref.  1 7). 


Normalized  NH  Speed 


Figure  4. — Baseline  and  optimized  acceleration  schedules 
for  takeoff  acceleration  process. 
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Figure  5. — Thrust  response  curves  for  the  nominal 
and  optimized  acceleration  schedules. 
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Figure  6.— A  Life  Extending  Control  Architecture  to  adjust 
schedules  in  response  to  accumulated  damage. 


Adaptive  Control 

Generally,  adaptive  control  involves  the  matching  of  a  closed  loop  transfer  function,  and  as  the  plant  changes,  due 
to  variations  in  operating  point  for  instance,  the  controller  adjusts  its  gains  to  match  an  identified  plant  model.  In 
current  engines  the  Proportional-integral  (PI)  controller  gains  are  scheduled  on  a  parameter  such  as  fan  speed.  This 
method  assumes  that  the  engine  dynamics  do  not  change  significantly  over  time  relative  to  the  scheduling  parameter, 
or  that  the  controller  is  designed  to  be  robust  enough  to  accommodate  the  changes.  Although  the  controller  gains 
change  with  operating  condition,  there  is  some  argument  over  whether  this  should  be  considered  an  adaptive 
technique  since  they  are  scheduled  based  on  a  measured  or  computed  parameter  in  a  predetermined  way  without  any 
attempt  at  system  identification.18 
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An  opportunity  for  adaptation  within  the  current  engine  control  framework  concerns  adjusting  the  schedules  and 
limits  within  the  controller.  In  current  engine  controls,  a  Proportional-Integral  controller  is  used  to  maintain  fan 
speed  or  engine  pressure  ratio  about  a  steady  state  point.  When  the  reference  signal  changes  enough  that  the  engine 
will  no  longer  remain  near  steady  state,  acceleration  or  deceleration  schedules  or  limits  come  into  play,  which 
determine  the  rate  at  which  the  engine  will  transition  to  its  new  operating  point.  These  schedules  are  based  on 
considerations  such  as  stall  and  over  temperature  avoidance.  Thus  the  response  of  the  engine  may  be  slowed  down 
in  order  to  stay  within  operability  limits.  There  has  been  some  promising  preliminary  work  replacing  the  traditional 
limit  logic  with  fuzzy  limit  logic,  resulting  in  improved  transient  performance  with  potentially  less  fine-tuning  of  the 
controller.19 

Additionally,  no  matter  how  the  schedules  and  limit  logic  are  implemented,  it  may  be  appropriate  to  override  them 
in  some  emergencies.  Obstacle  avoidance,  emergency  egress,  and  compensation  for  damage20  are  all  examples  of 
situations  where  rapid  acceleration  might  be  critical  to  saving  the  vehicle.  One  solution  to  these  problems  involves 
developing  recon figurable  schedules  that  allow  the  engine  to  operate  beyond  its  normal  boundaries  for  a  short  time, 
at  the  risk  of  component  life,  but  with  the  benefit  of  potentially  saving  the  vehicle  and  passengers.-1 

Multivariable  Control 

Multivariable  control  moves  beyond  the  classical  transfer  function  approach,  emphasizing  the  state  space 
representation  of  the  system  model  (sets  of  first  order  ordinary  differential  equations  describing  the  behavior  of  a 
system).  The  state  space  formulation  led  to  the  development  of  theory  in  optimal  control  and  robust  stability,  as  well 
as  comprehensive  design  procedures,  and  many  other  advances.  This  progress  was  prompted  by  the  advent  of  the 
stored-program  digital  computer  and,  significantly,  the  requirements  of  the  aerospace  control  problem.2  Thus,  the 
introduction  of  the  electronic  engine  controller  opened  up  a  whole  new  application  area  for  multivariable  control, 
and  consequently  the  state  of  (experimental)  engine  control  has  been  greatly  advanced. 

Over  the  last  two  decades,  a  great  amount  of  research  has  been  published  related  to  multivariable  control  of  jet 
engines.23,24  Jet  engines  provide  an  excellent  test  bed  for  the  various  algorithms  because  they  are  complex,  nonlinear 
systems  with  significant  interaction  between  components.  There  is  the  opportunity  to  optimize  performance  of  the 
whole  system,  or  of  individual  components.  A  multivariable  control  exploits  both  the  knowledge  of  the  physical 
plant,  such  as  the  gas  turbine,  and  the  multiple  inputs  and  outputs  to  the  control  system.  This  additional  complexity 
can  provide  the  control  system  designer  additional  techniques  to  optimize  the  plant  performance.2' 

The  Full  Authority  Digital  Engine  Controller  (FADEC)  enables  the  implementation  of  multivariable  control 
schemes,  as  well  as  related  technologies  that  they  depend  on,  such  as  estimators  of  unmeasured  state  variables. 
However,  these  schemes  rely  on  the  existence  of  good  models  for  the  design  process.  Trade-offs  may  be  made 
between  model  uncertainty  and  performance,  and  multivariable  control  schemes  do  not  lend  themselves  to  “tuning.” 

In  order  to  achieve  a  successful  multivariable  control  implementation,  the  control  designer  must  first  develop  a 
robust,  adequately  descriptive  model  of  the  plant,  derived  from  the  inherent  physics.  Next,  the  control  system  must 
be  designed  with  a  properly  nested  loop  structure  which  adequately  considers  the  multiple  input  and  output  variables 
as  well  as  their  interactions.  Finally  it  must  be  extensively  validated  and  calibrated  against  experimental  data,  such 
as  that  collected  on  the  engine  test  stand  and  in  flight  test. 

Multivariable  control  offers  superior  performance  to  traditional  PI  control.  Multivariable  control  avoids  the 
pitfall  of  multi-loop  control,  specifically  the  need  to  sub-optimize  the  control  loops  to  avoid  system  instability  due  to 
the  interaction  of  the  separate  control  loops.  Instead,  multivariable  controllers  take  into  account  loop  interactions  and 
their  de-stabilizing  effects,  allowing  the  overall  system  to  be  optimized,26  and  augmentation  with  artificial 
intelligence  (AI)  techniques  may  produce  even  better  performance.2  Furthermore,  the  multivariable  control  provides 
“virtual  measurement”  of  system  parameters  that  are  not  directly  measured  but  can  nevertheless  be  used  for 
monitoring  or  even  control.  This  performance  improvement  must  be  evaluated  against  the  increased  complexity  and 
up-front  development  time  and  cost  in  order  to  assess  its  net  benefit  to  the  aircraft  propulsion  capability. 

Performance  Seeking  Control 

Aircraft  engine  performance  seeking  control  technology  has  been  advanced  under  a  number  of  DoD  and  NASA 
led  programs. 28*''  The  goal  of  performance  seeking  control  is  to  operate  the  engine  in  a  manner  to  achieve  optimal 
performance  based  upon  the  current  condition  of  the  engine  and  the  current  mission  of  the  aircraft.  Optimal 
performance  is  typically  defined  in  terms  of  fuel  bum,  thrust,  engine  life,  or  a  combination  of  these  objectives. 

A  comparison  between  a  conventional  aircraft  engine  control  architecture  and  a  performance  seeking  control 
architecture  is  shown  in  figure  7.  In  both  cases  the  engine  control  system  is  responsible  for  providing  the  desired 
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Figure  7. — Comparison  of  conventional  and  Performance  Seeking  Control  Architectures. 


level  of  thrust  while  maintaining  the  necessary  operability  margins  at  steady-state  and  transient  operating  conditions 
throughout  the  engine  operating  envelope.  Since  engine  parameters  such  as  thrust  and  stall  margin  are  not  directly 
measurable,  the  conventional  control  design  approach  is  to  infer  these  parameters  through  other  direct  sensor 
measurements  such  as  rotor  speeds  and  pressure  ratios.  Complicating  this  process  is  the  fact  that  slight  performance 
variations  always  exist  between  engines  due  to  engine-to-engine  manufacturing  variations.  Furthermore,  each 
individual  engine  will  naturally  undergo  degradation  over  its  lifetime  of  use.  To  account  for  these  variations  the 
conventional  control  system  must  be  designed  to  ensure  robust  operation  for  a  range  of  engine  conditions  from  fully 
healthy  to  fully  degraded.  However,  this  robustness  is  obtained  in  exchange  for  performance.  Performance  seeking 
control  aims  to  address  some  of  the  shortcomings  of  conventional  control  logic  by  directly  controlling  the 
parameters  of  interest,  and  optimizing  engine  operation  based  upon  the  current  condition  of  the  engine.  This  is 
achieved  by  using  a  real-time  on-board  aerothermodynamic  engine  model  incorporated  into  the  engine  control 
architecture  as  shown  in  figure  7.  An  associated  on-line  parameter  estimation  algorithm,  or  tracking  filter,  adjusts 
model  tuner  parameters  to  match  the  performance  of  the  physical  engine.  Linear  estimation  techniques,  such  as 
Kalman  filters,  are  often  used  to  implement  the  tracking  filters.  Once  the  on-board  model  is  accurately  tuned  it 
provides  accurate  estimates  of  sensed  engine  outputs  as  well  as  estimates  of  unmeasurable  engine  parameters  such 
as  stall  margin  and  thrust  which  can  be  used  for  direct  feedback  control  purposes.  By  adapting  to  account  for  engine 
variations  and  controlling  directly  on  the  parameters  of  interest,  the  engine  control  can  be  optimized  to  provide 
enhanced  performance  while  still  providing  the  necessary  degree  of  robustness. 

In  the  past,  performance  seeking  control  technology  has  been  evaluated  in  engine  ground-based  tests  and  flight 
test  environments  demonstrating  the  benefits  of  the  technology.  It  should  be  noted  that  any  model-based 
performance  seeking  control  technology  is  only  as  accurate  as  its  corresponding  on-board  model.  Therefore  any 
advances  in  on-board  modeling  or  tracking  filter  technology  will  directly  enhance  the  capabilities  of  such  model- 
based  control  approaches.  ’2  Additional  advances  are  required  in  terms  of  control  logic  verification,  validation  and 
certification.  Any  adaptive  control  technology  must  adequately  address  these  issues  to  ultimately  transition  into 
service.  The  on-board  model  estimation  and  tracking  technology  is  not  unlike  the  estimation  techniques  used  for 
ground-based  performance  diagnostics.  In  addition  to  the  control  functionality  that  it  provides,  an  added  benefit  of 
having  a  real-time  on-board  performance  model  is  that  it  supplies  real-time  continuous  trending  of  engine 
component  health  and  can  be  invaluable  for  fault  detection  and  isolation  purposes. 

Model  Predictive  Control 

Model  Predictive  Control  (MPC)  is  unusual  in  that  it  is  actually  an  open  loop  control  scheme.  The  premise  behind 
it  is  that  an  on-board  model  is  running  faster  than  real  time,  using  simulated  control  inputs  over  a  time  horizon 
(fig.  8).  The  best  simulated  control  input  at  the  current  time  is  then  used  as  input  to  the  real  engine.  This  sequence  is 
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Figure  8. — Model  Predictive  Control,  prediction  horizon  and  control  horizon. 

repeated  at  each  time  step,  computing  and  applying  the  best  control  input  each  time.  Because  it  is  always 
determining  the  optimal  control  by  projecting  out  in  time,  the  system  is  technically  running  open-loop,  where  the 
success  of  the  control  sequence  depends  on  the  accuracy  of  the  model.  Research  implementations  have  used  both  a 
piecewise  linear  model''  and  a  nonlinear  Component  Level  Model  (CLM)  linearized  at  each  time  step'4  as  the  on¬ 
board  model. 

One  of  the  advantages  of  this  technique  is  that  the  goals  and  constraints  may  be  changed  on  line.  An  example  of 
this  is  that  the  controller  can  minimize  temperature  increase  during  transient  operation  while  minimizing  specific 
fuel  consumption  during  cruise.  It  is  a  complex,  computationally  intensive  scheme,  however,  which  requires  a  lot  of 
on-board  computing  power  to  run  a  model  many  times  faster  than  real  time.  Additionally,  the  model  must  be  highly 
accurate,  even  at  off-nominal  conditions,  for  the  MPC  methodology  to  be  successful. 

Diagnostics 

The  objective  of  a  diagnostic  system  on  a  turbofan  engine  is  to  avoid  catastrophic  failures,  prevent  costly  damage 
to  engine  components,  provide  accurate  fault  detection  and  isolation  to  maintenance  personnel,  and  reduce  costs  due 
to  premature  or  past-due  maintenance. 

Often,  such  intelligent  systems  architectures  are  simply  an  artifact  of  the  capabilities  of  the  underlying  available 
tools.  The  opposite  of  this  “invisible  hand"  design  is  an  explicitly-designed  architecture  that  guides  the  software 
system  development.  The  high-level  factors  that  affect  the  design  are  available  technology  (e.g.,  neural  network  or 
rule-based  reasoning)  and  the  target  application.  A  flexible  architecture  will  allow  adaptation  to  new  technologies, 
such  as  64-bit  processors,  wireless  sensor  networks  and  newer  compilers,  while  allowing  optimizations  of  accuracy, 
speed,  and  cost  of  system  health  management. 

Health  management  involves  the  complete  path  from  sensing  the  value  of  a  particular  measurement  to  the 
execution  of  a  particular  action  that  enables  optimal  performance.  In  general,  techniques  in  classification,  inference, 
projection,  and  decision  making  can  be  applied  to  areas  such  as  diagnosis,  prognosis,  condition-based  maintenance, 
and  fleet  management.  Diagnosis  can  be  performed  using  inductive  learning  such  as  decision  trees,35  case-based 
reasoning,  rule-based  or  model-based  approaches,36*3  explanation-based  learning,  genetic  algorithms  for  search  and 
optimization,  neural  networks,  fuzzy  learning  and  soft  computing  techniques. 

For  engine  health  management,  the  specific  tasks  may  include  a  subset  of  fault  detection,  isolation,  identification, 
prediction,  explanation,  remediation  and  simulation.  Usually  the  most  important  fault  characterizations  are  how  they 
manifest,  what  causes  them,  and  what  they  affect. 

Faults  can  be  broadly  categorized  as  follows: 

1)  When  they  occur:  during  the  initial  phase,  during  the  regular  operation  phase  or  end-of-mission  phase 
(there  is  a  usually  bathtub  curve  for  probability  of  fault  occurrence  versus  time) 

2)  How  long  they  last:  whether  permanent,  temporary,  or  intermittent 

3)  How  they  manifest:  whether  discrete  or  continuous  (e.g.,  leak),  abrupt  or  gradual 

4)  How  they  relate  to  other  faults:  whether  independent,  correlated,  cascading,  or  simultaneous  faults  with  a 
common  cause 
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5)  What  causes  them:  inherent  in  design  (structural  or  functional),  due  to  uncertainties  in  operating  envelope, 
or  due  to  external  conditions 

6)  What  they  affect:  the  component,  the  subsystem  or  the  system 

7)  How  critical  are  they:  non-critical,  recoverable  or  mission-critical 

Expected  failure  rates  for  many  system  components  are  usually  outlined  in  a  Failure  Modes  and  Effects  Analysis 
(FMEA).  Other  domain  knowledge,  required  to  build  a  model  of  the  system,  comes  from  schematics,  block 
diagrams,  instrumentation  list  (sensor  type,  location,  number,  redundancy,  sampling  rates),  telemetry  list  and  the 
operations  timeline.  There  may  also  be  information  from  fault  analyses — fault  trees,  event  trees,  and  probabilistic 
risk  assessment. 

Software  quality  assurance  is  critical,  especially  if  the  controller  action  depends  upon  the  results  of  the 
diagnostic  system.  The  implemented  software  system  for  aircraft  engine  control  will  be  a  safety-critical,  real-time 
system.  It  must  satisfy  explicit  response  time  constraints.  In  addition,  it  must  integrate  with  external  software  (such 
as  diagnostic  software  from  other  subsystems)  and  share  information  with  it.  To  implement  such  high  performance 
diagnostic  software,  appropriate  software  engineering  practices  must  be  followed  right  from  the  beginning.  This 
includes  all  phases  such  as  requirements  specification  (for  the  controller  and  for  the  software),  executable 
specifications,  reliable  coding  practices  and  code  generation,  performance  analysis,  and  verification  and  validation 
of  the  system. 

Engine  malfunctions  constitute  a  significant  percentage  of  in-flight  problems.  While  Engine  Monitoring  Systems 
(EMS)  are  routinely  used,'*  the  abundance  and  ambiguity  of  data,  combined  with  simple,  threshold-based  triggers, 
results  in  a  high  percent  of  “nuisance”  alarms  that  are  costly  to  address.  An  additional  challenge  is  the  ability  to 
record,  store  on-board,  transmit  to  ground,  store  on  ground,  and  interpret  vast  amounts  of  diverse  data,  and  the 
ability  to  distill  relevant  information  and  useful  knowledge.  On-board  monitoring  isn't  an  end  goal,  but  an  essential 
step  in  diagnosis,  prognosis  or  intelligent  control.  The  rest  of  this  section  discusses  various  aspects  of  engine  system 
and  component  diagnostics  that  are  currently  under  development. 


Gas  Path  Performance  Diagnostics 

Gas  path  performance  diagnostics  involves  estimating  the  values  of  specific  variables  associated  with  the  gas  path 
components,  or  changes  in  these  values  that  might  indicate  a  fault.  It  is  important  to  distinguish  between  the  general 
health  of  the  engine  gas  path  components  and  sudden  faults.  The  general  health  of  the  engine  is  equivalent  to  its 
level  of  degradation  or  effective  age,  and  is  the  baseline  from  which  changes  are  measured.  In  the  gas  path,  the 
health  condition  of  each  component  is  defined  by  its  efficiency  and  other  parameters  that  change  slowly.  In  general 
there  are  not  enough  engine  sensors  available  to  allow  estimation  of  these  health  parameters  in  flight.  Some 
diagnostic  schemes  relate  faults  to  abrupt  changes  in  the  parameters  associated  with  component  health.  Thus,  on-line 
monitoring  of  unmeasurable  variables  is  the  basis  for  many  fault  detection  and  isolation  approaches.'0  The 
information  flow  diagram  in  figure  9  indicates  how  damage  and  wear  is  related  to  degraded  performance.40  Many 
linear  and  nonlinear  techniques  have  been  applied  to  this  problem,  but  without  the  addition  of  diagnostic  sensors,  the 
problem  will  remain.  The  estimation  problem  arises  because  the  number  of  health  parameters  exceeds  the  number  of 
measurements,  which  means  that  the  problem  is  underdetermined  and  thus  the  health  parameter  shifts  can  not  be 
uniquely  determined.41  The  problem  is  further  complicated  by  estimation  errors  due  to  model  mismatch,  noise  and 
sensor  bias.  The  sensor  validation  issue  is  addressed  in  the  section  on  Control  System  Integrity  Assurance. 
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Figure  9. — Diagram  indicating  information  flow  for  turbine  engine  gas  path  diagnostics. 
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Vibration  Diagnostics 

In  all  but  some  specialized  cases,  vibration  diagnostics  are  used  for  trending  of  structural  health.  Increases  in 
vibration  amplitude  over  time  might  indicate  a  change  in  rotor  balance  related  to,  for  instance,  a  damaged  fan  blade 
or  a  bearing  failure.  The  low  sample  rate  of  the  measurement  essentially  precludes  its  use  as  a  real-time  diagnostic 
tool,  but  many  possibilities  will  be  opened  up  when  high  frequency  measurements  become  available  along  with  on¬ 
board  signal  processing.  Sensors  with  higher  frequency  capability  combined  with  more  sophisticated  processing  can 
detect  more  subtle  degradation  of  bearings,  gearing,  accessories  and  structural  components.  The  cost  of  this 
enhancement  is  not  negligible,  notably  in  the  signal  processing  and  communication  and  display  of  the  resultant 
information,  but  the  main  hurdle  is  the  testing  and  ongoing  analysis  necessary  to  define  the  relevant  signatures,  and 
incorporate  them,  as  failure  modes  surface. 

Lubrication  System  Diagnostics 

Diagnostics  for  lubrication  systems  focus  on  such  things  as  contaminants  in  the  oil.  This  gives  an  indication  of 
wear  to  internal  parts  as  well  as  damage  progression,  and  since  the  metal  chips  that  the  sensors  observe  are  from 
individual  parts,  it  may  be  able  to  isolate  the  damage  location  as  well. 

Some  work  has  been  done  in  fusing  vibration  and  lubrication  system  diagnostics  to  achieve  a  higher  level  of 
confidence  in  the  detection  of  part  wear,  and  it  will  lead  to  improvements  in  the  development  of  future  health 
monitoring  systems.42 


Control  System  Integrity  Assurance 

A  large  component  of  propulsion  diagnostics  is  the  critical  function  of  control  system  fault  detection  and  isolation. 
Some  of  this  is  based  on  basic  control  system  sensors,  and  primarily  position  feedbacks  (continuous  and  switch 
position).  With  the  advent  of  FADEC’s,  dedicated  self-test  circuitry  is  required  to  ensure  the  integrity  of  the  control 
system  itself  while  providing  necessary  levels  of  fault  isolation  to  line  replaceable  units  (LRUs). 

While  implementation  has  improved  over  the  past  two  decades,  poor  control  system  diagnostics  and  fault  isolation 
continue  to  bedevil  flight  operations  with  unacceptable  "no  fault  found"  control  component  removals.  Selectively 
applying  the  methods  being  developed  for  engine  health  management,  including  a  systems  engineering  approach, 
dedicated  sensors  and  prognostics  to  control  system  integrity  may  be  cost  effective.  Complex  fuel  pumps,  fuel 
metering  units,  actuators,  electrical  power  systems  and  oil  system  components  can  be  monitored  for  performance 
degradation  by  using  existing  or  added  sensors  to  sense  and  trend  temperature,  differential  pressure,  slew  rates, 
valve  position,  etc.  Blade  tip  clearance  sensors  being  considered  for  active  control  have  the  potential  to  detect  and 
isolate  a  major  cause  of  performance  degradation.  Microwave  and  optical  sensors  proposed  for  tip  clearance 
measurement  can  provide  high  frequency  tip  timing  data  permitting  detection  of  deflection  and  vibration  of 
individual  blades,  and  isolation  of  blade  damage.  The  signal  and  data  processing  burdens  are  disincentives  that  may 
be  overcome  by  the  benefits  to  specific  engines. 

A  specialized  and  well-developed  area  of  control  system  integrity  assurance  is  sensor  validation  (fig.  10).  Sensor 
validation  schemes  tend  to  be  model-based  in  that  the  residuals  (the  differences  between  sensor  measurements  and 
model-synthesized  estimates)  are  checked,  and  a  large  residual  indicates  that  a  fault  has  occurred.  The  engine  model 
can  be  built  in  various  ways  that  directly  relate  to  the  validation  scheme  to  be  used.  For  instance,  least-squares-type 
parameter  estimation  schemes  can  provide  estimates  of  sensor  gain  and  bias  faults  by  incorporating  these  parameters 
into  the  plant  model.4' 

Another  method  of  sensor  validation  relies  on  a  bank  of  Kalman  filters  (fig.  1  1  ).44  4"  A  Kalman  filter  takes  in 
sensor  readings  and  produces  state  variable  estimates  that  are  used  with  a  built-in  plant  model  to  generate  sensor 
estimates.  The  bank  of  Kalman  filters  consists  of  multiple  filters,  each  of  which  utilizes  a  different  sensor  suite.  The 
first  filter  uses  all  but  the  first  sensor  as  input,  the  second  filter  uses  all  but  the  second  sensor  as  input,  and  so  on. 
Thus,  each  filter  tests  the  hypothesis  that  the  sensor  it  does  not  include  is  faulty.  When  a  sensor  fault  occurs,  the 
output  of  all  filters  but  one  will  be  corrupted  by  the  faulty  information.  Therefore,  the  fault  causes  the  residuals 
associated  with  all  filters  but  the  one  that  does  not  use  the  bad  information  to  grow  large,  revealing  the  defective 
sensor. 

This  method  has  been  extended  from  sensor  fault  detection  and  isolation  to  include  actuator  and  component  fault 
detection  as  well.46  This  is  accomplished  by  adding  an  additional  Kalman  filter  that  utilizes  all  sensors,  and 
estimates  several  tuning  parameters  in  addition  to  the  state  variables  to  account  for  model  mismatch  due  to 
component  or  actuator  faults.  If  the  tuning  parameter  estimates  become  large  while  the  residuals  in  the  sensor  fault 
hypothesis  filters  remain  small,  it  indicates  that  the  fault  is  probably  in  a  component  or  actuator. 
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Figure  10. — Generic  sensor  validation  scheme. 


I  Fault  Indicator  Signal  Generation  Process  i  Fault  Isolation  Process 


Figure  1 1. — Bank  of  Kalman  filters  sensor  validation  scheme,  estimates  are 
compared  to  measured  outputs  and  residuals  are  used  to  declare  a  fault. 
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Figure  12. — Artificial  neural  network  sensor  validation  scheme;  network  recreates 
outputs  from  measurements,  even  if  a  measurement  is  corrupted. 
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Yet  another  method  for  performing  sensor  validation,  using  an  artificial  neural  network  (ANN),  was  demonstrated 
in  simulation  in  NASA's  High  Reliability  Engine  Control  program,47  and  was  subsequently  applied  to  a  helicopter 
turboshaft  engine  as  well  (fig.  12).48  The  ANN  consists  of  an  input  and  output  layer  with  the  number  of  nodes  equal 
to  the  number  of  sensors.  There  are  three  hidden  layers:  mapping,  bottleneck,  and  demapping.  The  mapping  and 
demapping  layers  are  both  large  compared  to  the  input  and  output  layers.  The  bottleneck  layer  is  small,  and  is 
trained  to  represent  only  the  essential  information  contained  in  the  system  outputs.  This  ANN  formulation  can  be 
robust  enough  to  reproduce  accurate  sensor  estimates  (outputs)  even  with  a  faulty  input.  Sensor  outputs  are  fed  into 
the  input  layer  of  the  ANN  and  compared  to  its  output.  If  they  are  similar  the  sensors  are  considered  to  be  operating 
properly.  If  an  input  and  output  diverge,  the  sensor  is  declared  faulty  and  the  ANN's  estimate  can  be  used  to  replace 
the  bad  sensor,  thus  providing  sensor  fault  isolation  and  accommodation. 

Diagnostic  sensors 

In  general,  the  sensors  on  which  propulsion  diagnostics  are  founded  are  the  engine  sensors  that  were  in  place 
before  the  advent  of  electronic  controls.  These  include  fuel  flow  meters,  oil  system  chip  detectors,  oil  level 
indicators  and  pressure  switches,  vibration  pickups,  temperature,  pressure,  and  rotor  speed  measurements.  These 
items  are  diagnostic  to  some  extent,  and  regulatory  mandates  and  established  procedures  have  "grandfathered"  them. 
The  criticality  of  these  sensors  to  mission  readiness  and  performance  ensures  that  they  are  robust  and  well 
maintained. 

Most  deployed  engine  health  management  systems  depend  primarily  on  this  core  sensor  set,  and  have 
demonstrated  significant  diagnostic  capability.  The  cost  effectiveness  and  suitability  of  additional  dedicated 
diagnostic  sensors  will  continue  to  be  challenged,  and  each  such  sensor  must  show  strong  promise  to  counter  the  risk 
that  the  costs  and  added  operational  complexity  will  outweigh  any  practical  gain.  The  severe  thermal  and  vibration 
environment  on  the  gas  turbine,  combined  with  the  volume,  weight  and  design  limitations  imposed  by  integration 
into  a  gas  turbine,  make  this  more  difficult.  The  low  production  volumes  of  unique  diagnostic  sensors  compound  the 
problem. 

Note  that  the  cost  of  monitoring  an  additional  engine  parameter  is  not  limited  to  the  sensor  itself.  The  cost  of 
additional  harness  wires,  connector  pins,  dedicated  driver  and  signal  acquisition  hardware,  analog  to  digital 
conversion,  and  software  and  computational  burden  outweigh  the  recurring  cost  of  the  sensor.  For  high  bandwidth 
sensors  (higher  frequency  vibration,  dynamic  pressure,  blade  tip  timing,  optical  and  microwave  sensing  etc.),  or 
other  sensors  applications  requiring  sophisticated  real  time  processing  for  feature  extraction  (e.g.,  electrostatic  gas 
path  and  oil  debris),  the  electronic  hardware  and  (often  dedicated)  computational  burden  far  outweigh  other 
considerations. 

The  challenge  for  proactive  engine  health  management  is  the  development  of  diverse  sensor  suites  with  common 
interfaces  to  standardized  electronic  signal  acquisition  hardware,  and  flexible  hardware  and  object  oriented  software 
architectures  facilitating  rapid,  economic  modification  of  the  diagnostic  sensor  kit  to  address  unanticipated  failure 
modes  and  operational  conditions. 

Multiplexed  sensor  interfaces,  so  one  standard  I/O  channel  can  serve  multiple  sensors,  is  established  practice  in 
industrial  sensor  applications.  However,  “smart  sensors"  equipped  for  data  bus  communication  perpetuate  dedicated 
signal  processing  electronics  in  adverse  environments  that  increase  costs  by  an  order  of  magnitude.  Advances  in 
high  temperature  electronics  or  "passive"  sensor  multiplexing  may  make  this  avenue  more  promising  for  gas  turbine 
applications. 

The  classes  of  dedicated  sensors  currently  being  employed  or  advanced  for  engine  monitoring  and  diagnostics  are, 
in  rough  order  of  priority  or  viability: 

1 )  Component  aero-thermodynamic  performance 

2)  Oil  borne  debris  and  oil  contamination/degradation 

3)  High  frequency  vibration 

4)  Gas  path  debris  and  foreign  object  ingestion/damage 

5)  Turbomachinery  (clearances,  blade  and  disk)  integrity /degradation 

6)  Other  (secondary  air/oil  scavenge  systems,  etc.) 

Data/Information  Fusion 

The  value  of  individual  sensors  may  become  less  intrinsic  and  more  dependent  on  synergies  gained  from  data 
fusion  across  diverse  sensors  as  more  sophisticated  diagnostic  and  engine  health  management  techniques  gain 
acceptance,  particularly  in  compensating  for  the  unacceptably  high  false  positive  rates  of  many  sensors  and 
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algorithms.  A  wealth  of  aircraft  turbine  engine  data  is  available  from  a  variety  of  sources  including  on-board  sensor 
measurements,  operating  histories,  and  component  models.  Furthermore,  additional  data  will  become  available  as 
advanced  prognostic  sensors  are  incorporated  into  next  generation  gas  turbine  engine  systems.  The  challenge  is  how 
to  maximize  the  meaningful  information  extracted  from  these  disparate  data  sources  to  obtain  enhanced  diagnostic 
and  prognostic  information  regarding  the  health  and  condition  of  the  engine.  One  approach  to  addressing  this 
challenge  is  through  the  application  of  data  fusion  techniques.  Data  Fusion  is  the  integration  of  data  or  information 
from  multiple  sources,  to  achieve  improved  accuracy  and  more  specific  inferences  than  can  be  obtained  from  the  use 
of  a  single  source  alone.  It  draws  from  a  wide  range  of  technology  areas  including  artificial  intelligence,  pattern 
recognition,  statistical  estimation,  and  fuzzy  logic.  The  basic  tenet  underlying  the  data/information  fusion  concept  is 
to  leverage  all  available  information  to  enhance  diagnostic  visibility,  increase  diagnostic  reliability  and  reduce  the 
number  of  diagnostic  false  alarms.  Under  a  NASA-funded  effort,  data  fusion  techniques  are  being  applied  for 
aircraft  gas  turbine  engine  health  management  purposes.49  This  effort  is  closely  aligned  with  the  ongoing  C-17 
Propulsion  Health  Management  Flight  Test  Program  led  by  NASA  Dryden  and  is  being  applied  to  the  Pratt  & 
Whitney  FI  17  engine  which  powers  the  C-17  aircraft.  An  overview  of  the  Data  Fusion  architecture  developed  under 
this  activity  is  shown  in  figure  13. 

It  is  a  hierarchical  architecture,  which  monitors  engine  sensor  information,  performs  signal  processing,  data 
analysis  and  health  assessment,  and  provides  maintenance  action  recommendations  to  the  end  user.  It  is  also  an  open 
and  modular  architecture  which  allows  additional  sensor  information  and  diagnostic  modules  to  be  added  as  they 
become  available.  In  figure  13  a  variety  of  information  sources  can  be  seen  including  sensor  measurements,  FADEC 
fault  codes,  maintenance  and  pilot  observations,  and  engine  maintenance  history  information.  While  these 
information  sources  are  rich  in  content,  they  exist  in  vastly  different  formats  and  sample  rates.  For  example 
advanced  vibration  sensor  measurements  may  be  sampled  in  the  10’s  of  kilohertz  range  whereas  gas  path 
measurements  may  be  sampled  in  the  10’s  of  hertz  range.  Due  to  the  disparate  sample  rates  among  system 
measurements,  a  necessary  function  to  be  performed  prior  to  subsequent  fusion  is  data  alignment,  which  time 


Figure  13. — Health  Management  Data  Fusion  Architecture  (adapted  from  ref.  49). 
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synchronizes  all  system  information  to  a  common  sampling  rate.  This  is  accomplished  by  up  and  down  sampling  the 
raw  information.  Converting  the  information  to  a  common  time  frame  helps  support  the  distinction  between 
correlated  and  non-correlated  system  events.  The  point  in  the  process  at  which  data  alignment  is  performed  on  the 
information  is  significant,  particularly  for  any  high  frequency  measurements  as  the  user  wants  to  avoid  the  loss  of 
any  critical  health  information  contained  within  the  raw  data.  As  shown  in  figure  13,  data  analysis  and  feature 
extraction  of  the  high  frequency  sensor  measurements  occurs  prior  to  data  alignment.  The  analysis  modules  perform 
signal  processing  and  feature  extraction.  Example  modules  are  vibration  analysis,  lubrication  system  monitoring,  gas 
path  performance  monitoring,  and  fault  codes  generated  by  the  FADEC.  After  data  alignment  and  health  feature 
extraction  has  been  performed  the  information  is  provided  to  the  information  fusion  module.  The  principle  objective 
of  the  information  fusion  module  is  to  convert  multiple  sources  of  information  into  a  unified  engine  health 
assessment.  This  process  requires  a  fundamental  understanding  of  engine  malfunctions,  as  well  as  a  methodology  for 
inserting  evidence  to  support  (or  refute)  a  specific  root  cause  of  a  malfunction. 

There  are  a  variety  of  information  fusion  techniques  that  can  be  applied.50  Stochastic  data  fusion  approaches,  such 
as  a  Bayesian  Belief  Network  (BBN),  provide  a  confidence  level  in  the  existence  of  a  particular  fault.51  This  can  be 
useful  in  setting  detection  thresholds  to  obtain  acceptable  performance  in  terms  of  false  alarms  and  missed 
detections.  Stochastic  data  fusion  approaches  do  however  require  a  priori  conditional  probabilities  for  fault 
occurrence,  fault  detection,  and  fault  missed  detections  to  be  specified.  For  aircraft  gas  turbine  engine  health 
management  applications  precise  conditional  probability  information  is  often  unavailable.  Also,  as  the  number  of 
fault  types  and  the  number  of  fused  diagnostic  modules  grows,  the  required  number  of  conditional  probabilities  that 
must  be  specified  grows  exponentially.  An  alternate  fusion  approach  is  the  Fuzzy  Belief  Network  (FBN).4)  5~  5' 
FBN’s  use  fuzzy  belief  functions  to  assign  confidence  levels  in  lieu  of  exact  conditional  probabilities.  They  are  also 
more  computationally  tractable  than  BBN’s.  FBN’s  do  require  expert  knowledge  to  generate  the  parametric  inter¬ 
relationships  and  assign  fuzzy  levels  of  confidence.  The  final  step  in  the  above  information  fusion  architecture  is  the 
fault  isolation  reasoner  module  which  processes  the  engine  health  assessment  information  along  with  past 
maintenance  and  pilot  observations,  and  makes  recommended  maintenance  actions.  It  consists  primarily  of  a  Failure 
Modes  Effects  and  Criticality  Analysis  (FMECA)  model  of  the  engine  along  with  a  line  maintained  Fault  Isolation 
Manual  (FIM)  procedure.40 

Applying  information  fusion  techniques  to  the  aircraft  gas  turbine  engine  health  management  application  does 
hold  much  promise.  Areas  for  future  enabling  work  include  instituting  the  necessary  process  to  collect  and  maintain 
a  suitable  aircraft  engine  fault  database.  Such  a  fault  database  would  be  critical  for  providing  the  necessary 
conditional  probability  information  required  by  stochastic  data  fusion  techniques.  Another  requirement  for  an 
effective  information  fusion  architecture  is  to  have  a  rich  source  of  information  and  diagnostic  methods.  Orthogonal 
information  and  diagnostic  methods  are  ideal,  as  they  will  be  complimentary  in  corroborating  or  refuting  a  broad 
range  of  fault  scenarios.  On  the  other  hand,  the  fiision  of  information  and/or  methods  that  are  either  highly 
correlated  or  uncorrelated  in  their  fault  coverage  will  provide  little  benefit  versus  using  the  diagnostic  techniques 
independently.  Thus  effective  system  studies  need  to  be  performed  to  include  within  the  fusion  architecture  the 
correct  combination  of  sensors  and  algorithms  to  address  the  faults  of  interest. 

Prognostics 

The  term  prognostics,  when  applied  to  turbine  engine  components,  generally  refers  to  an  estimate  of  the 
remaining  useful  or  safe  life.  Specific  components  such  as  turbine  disks  have  a  mandated  life  in  terms  of  take-off 
and  landing  cycles  after  which  they  must  be  removed  from  service.  This  safe  life  is  determined  through,  among 
other  things,  material  testing,  spin  testing,  and  finite  element  analysis.  A  life  distribution  is  obtained  based  on  some 
assumptions  about  operating  conditions  and  the  safe  life  limit  is  defined  in  terms  of  probability  of  failure  (fig.  14). 
Because  of  the  expected  spread  in  the  time-to- failure  distribution,  it  turns  out  that  most  disks  are  removed  with  over 
90  percent  of  their  useful  life  remaining.  The  monetary  wastefulness  of  this  retirement  for  time  approach  has 
prompted  work  in  the  area  of  retirement  for  cause ,  in  which  life-limited  parts  are  removed  based  on  inspection 
findings  rather  than  cycle  count  alone.  Even  though  this  approach  is  more  cost  effective,  without  an  on-line  crack 
detection  system  it  is  time  consuming  and  labor-intensive.  Vibration,  acoustic,  tip  timing  and  direct  in  situ  sensors 
are  being  evaluated  as  a  means  to  this  end.  Extreme  dependability  requirements  in  a  difficult  environment  make  this 
a  challenging  task. 
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Figure  14. — Weibull  distribution  for  probability  of  failure. 

Other  engine  components  such  as  turbine  blades  are  replaced  as  a  result  of  inspection  findings.  Since  these  parts 
are  allowed  to  “fair  (defined  not  necessarily  by  breakage  but  by  visible  damage  accumulation),  it  is  possible  to 
develop  models  that  relate  usage  to  life  consumption  and  validate  them  on  in-service  parts.  New  sensor-based 
methods  combined  with  physics  of  failure  models  are  being  developed  that  relate  ambient  conditions'4  as  well  as 
internal  engine  conditions  to  life  usage.'"  These  software  enabled  approaches  relate  measurements  taken  on-line  to 
life  consumption  and  thus  give  a  much  better  estimate  of  the  true  remaining  life,  supporting  the  notion  of  condition- 
based  maintenance  and  allowing  the  convenient  scheduling  of  maintenance,  which  may  greatly  simplify  the 
logistical  problems  of  part  availability. 


Integration 

Up  to  this  point,  individual  approaches  and  algorithms  have  been  presented.  With  the  exception  of  the  data  fusion 
system  presented  previously,  these  are  stand-alone  algorithms,  and  while  some  of  them  individually  might  be 
considered  intelligent,  their  implementation  on  a  complex  system  like  an  engine  does  not  make  the  overall  system 
intelligent.  The  intelligence  comes  from  their  integration  in  such  a  way  that  they  interact  to  raise  the  level  of 
autonomy  of  the  system,  as  in  figure  3.  This  relates  to  real-time  operation  of  course,  but  to  achieve  future  cost  and 
performance  goals,  it  extends  to  maintenance  and  logistics,  and  it  requires  that  information  not  be  lost  as  parts  are 
swapped  or  equipment  upgraded.  This  implies  that  the  engine  has  self-knowledge  about  its  components  and  usage, 
i.e.,  on-board  knowledge  should  be  retained,  even  after  an  overhaul  has  been  performed. 

Integrated  Fault  Detection,  Isolation,  and  Accommodation  Logic 

The  ultimate  goal  of  an  aircraft  engine  health  management  system  is  to  accurately  and  reliably  detect  faults  prior 
to  their  escalation  into  more  serious  events.  While  this  is  a  noble  goal,  there  will  always  be  cases  where  early  fault 
prediction  will  not  be  possible,  and  in-flight  faults  occur.  Some  of  those  faults  can  be  mitigated  through  real-time 
integrated  fault  detection,  isolation,  and  accommodation  (FD1A)  logic  embedded  within  the  electronic  engine 
controller.  It  is  common  for  today’s  aircraft  gas  turbine  engines  equipped  with  electronic  engine  controls  to  have 
some  level  of  FDIA  capabilities.  For  example  limit  checks,  rate-of-change  checks,  and  simple  analytical  checks  are 
performed  to  validate  sensor  measurements.  Typically  engines  are  instrumented  with  physically  redundant  control 
feedback  sensors.  If  a  faulty  sensor  is  detected  the  accommodation  logic  will  revert  to  the  physically  redundant 
backup  sensor.  Likewise  dual  redundant  FADEC  channels  exist.  If  a  failure  in  the  primary  FADEC  unit  is  detected, 
the  system  reverts  to  the  backup  channel.  The  control  software  also  has  secondary  control  modes  to  aid  in  fault 
accommodation.  Upon  the  detection  of  specific  faults,  the  engine  control  logic  may  have  the  capability  to  revert 
from  its  primary  control  mode  to  a  secondary  control  mode  to  allow  the  engine  to  keep  operating  albeit  perhaps  with 
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reduced  performance.  The  introduction  of  electronic  engine  controls  has  made  such  automated  fault  diagnostics  and 
accommodation  capabilities  possible,  and  has  helped  to  significantly  improve  the  reliability  and  safety  of  aircraft 
propulsion  systems. 

The  future  vision  is  to  continue  to  enhance  the  automated  FDIA  capabilities  of  aircraft  engines.50  This  includes 
improving  sensor  and  actuator  FDIA  capabilities  and  expanding  FDIA  coverage  to  include  component  faults  as  well. 
The  use  of  real-time  on-board  adaptive  model  technology  described  in  the  Performance  Seeking  Control  section  of 
this  paper  can  be  beneficial  for  fault  diagnostic  purposes.  Such  an  approach  can  assist  in  the  early  and  reliable 
diagnosis  of  system  performance-related  faults  by  providing  an  added  level  of  analytical  redundancy.  While 
automated  FDIA  capabilities  hold  much  promise,  it  should  be  emphasized  that  they  are  not  a  panacea  for  dealing 
with  all  in-flight  propulsion  malfunction  scenarios.  Multi-engine  aircraft  are  designed  to  be  able  to  safely  operate 
with  an  engine  out.  There  will  be  some  engine  faults  that  simply  can  not  be  accommodated  in-flight,  and  in  those 
cases  the  right  decision  is  often  for  the  pilot  to  shut  down  the  faulty  engine.  Attempting  to  continue  to  operate  a 
faulty  engine  may  in  fact  incur  additional  damage  which  can  lead  to  the  need  for  costly  repairs,  or  worse  yet 
compromise  vehicle  safety.  Another  caveat  regarding  automatic  reconfigurable  controls  is  the  need  to  ensure  that 
they  do  not  mask  important  sensory  cues  that  pilots  rely  on  to  assist  them  in  diagnosing  faults.  Furthermore,  steps 
must  be  taken  to  ensure  that  automatic  reconfigurable  controls  are  not  invoked  erroneously,  and  that  they  do  not 
exacerbate  existing  faults.  Suitable  verification,  validation,  and  certification  techniques  will  be  crucial  in  ensuring 
that  FDIA  techniques  are  not  prone  to  these  pitfalls. 

MPC  for  Integrated  Control  and  Diagnostics 

MPC  lends  itself  directly  to  integrated  control  and  diagnostics  as  long  as  the  model  is  capable  of  capturing  the 
effect  of  the  fault.  Thus  MPC  in  the  presence  of  a  fault  is  no  different  than  in  the  unfaulted  case,  because  the 
simulation  over  the  time  horizon  accounts  for  the  fault,  and  still  selects  the  optimal  control  accounting  for  it.  For 
example,  given  that  an  actuator  is  stuck,  the  faulty  system  may  be  treated  as  a  '■‘new”  system,  where  the  effect  of  the 
stuck  actuator  may  be  an  exogenous  input,  and  the  control  system  will  have  one  fewer  actuator  to  work  with;  this 
might  also  be  handled  as  a  new  constraint  on  an  existing  actuator's  movement.  This  generalization  of  the 
reconfiguration  problem  makes  MPC  ideal  for  switching  in  real  time  between  various  plant  models  representing 
baseline  and  damaged  engines,  accommodating  faults  naturally  within  the  framework  of  the  problem  statement. 

Engine  Health  Management,  Support  Engineering,  Maintenance  and  Logistics  Integration 

Automated  engine  health  management  has  the  potential  to  significantly  reduce  maintenance  effort  and  propulsion 
systems'  logistical  footprint.  More  detailed  data  on  equipment  reliability  and  failures  is  also  crucial  for  support 
engineering  to  prioritize  and  resolve  problems  in  the  field  -  both  with  equipment  design  and  with  operations  and 
maintenance  procedures  and  tooling. 

The  industry  is  attempting  to  redefine  and  automate  equipment  servicing,  with  an  emphasis  on  A1  and  logistics 
techniques  to  minimize  the  human  factor.  As  usual,  incomplete  process  mapping  and  integration  of  the  change  effort 
across  all  process  steps  and  players  is  the  major  impediment  to  defining  and  implementing  effective  process 
improvement.  The  Joint  Strike  Fighter  program  is  a  leading  proponent  within  the  DoD,  but  there  are  many  other 
initiatives  attempting  to  integrate  support  processes  across  all  weapons  platforms.  In  the  civil  world,  lease  and 
maintenance  contracts  have  motivated  the  engine  companies  to  evolve  in  the  same  direction. 

Information  Technology  (IT)  structures  and  data  management  must  be  robust  and  support  flexible  distributed  data 
processing,  analysis  and  decision-making.  Ideally,  from  the  front  line  maintainer  to  the  technician  repairing  a 
subcomponent  of  a  subsystem,  all  players  should  have  ready  access  to  the  information  needed  to  plan  and  execute 
their  task  easily  and  intelligently. 

One  approach  to  this  challenge  is  the  U.S.  Army's  Automatic  Identification  Technology  (AIT)  initiative.5^  This 
approach  equips  all  LRU’s  with  embedded  memory  (often  passive  non-volatile  memory  (NVM)  modules  bonded  to 
the  item  but  accessible  with  a  laptop  equipped  with  a  read/write  wand)  that  contains  a  current  record  of  the  LRU’s 
configuration,  identity,  usage  and  maintenance  status,  synchronized  with  the  central  maintenance  database. 
(Similarly,  the  Pratt  &  Whitney  PW200  turboshaft  engine  has  a  NVM  module  fixed  to  the  engine,  as  the  engine 
often  gets  separated  from  its  FADEC  when  removed  from  the  aircraft  for  repair.)  Line  and  organizational 
maintainers  can  access  and  update  the  information,  which  is  also  readily  accessible  by  the  repair  depot  on  receipt  of 
a  failed  LRU.  This  parallel  data  structure,  physically  tied  to  the  affected  hardware,  provides  a  redundant 
communication  channel  that  adds  robustness  to  the  support  processes. 

For  example,  critical  LRUs  often  arrive  at  the  repair  depot  with  little  or  no  information  after  passing  through  the 
logistics  chain.  With  AIT,  the  LRU  will  carry  critical  data  in  embedded  NVM  identifying:  reason  for  removal. 
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relevant  FADEC  fault  codes,  line  maintenance  comments,  engine  serial  number  and  configuration,  airplane  tail 
number,  and  interfacing  LRU  identity  and  configuration  data;  even  critical  environmental,  usage  and  performance 
trend  information  can  be  made  available.  If  the  LRU  NVM  is  wired  to  the  FADEC,  this  data  can  be  automatically 
loaded  into  and  from  the  FADEC. 

Such  data  can  speed  initial  processing,  determine  whether  an  as-received  test  is  required  and  guide 
troubleshooting.  If  the  failure  mode  repeats,  the  AIT  data  can  provide  the  original  equipment  manufacturer  (OEM) 
support  engineering  valuable  leads  to  understanding  the  circumstances  and  cause,  and  facilitating  proactive 
identification  of  design  or  documentation  improvements.  When  the  unit  is  returned,  the  AIT  NVM  can  be  updated  to 
identify  repairs,  parts  replaced,  etc.  for  operator  reference  and  analysis  when  returned. 

Embedded  NVM  can  offer  benefits  beyond  engine  health  management.  The  OEM  can  load  sensor  calibrations 
and/or  effector  parameters  into  a  control  accessory  NVM,  which  can  effectively  increase  accuracy  and/or  reduce 
manufacturing  cost,  because  the  FADEC  can  read  the  NVM  data  to  adjust  sensor  readings  or  nominal  effector 
characteristics.  Manufacturing  tolerances  can  be  opened  up  and/or  more  precise  control  made  possible. 

Final  Comments 

This  paper  presents  a  survey  of  selected  research  into  Propulsion  Control  and  Health  Management  technologies. 
These  technologies  have  the  potential  to  play  a  large  role  for  future  intelligent  engines  in  the  context  of  VAATE  and 
NASA  goals.  Issues  specifically  related  to  future  engines  in  terms  of  software  enabled  on-board  technology  are 
presented.  By  omitting  technologies  that  require  the  addition  of  fundamentally  new  sensors  or  the  development  of 
other  enabling  technology,  the  conscious  decision  was  made  to  leave  out  an  area  that  that  is  considered  to  have  a 
very  high  pay-off  for  future  engines:  active  control.  There  is  no  doubt  that  advances  in  many  areas  will  need  to  be 
made  in  order  to  achieve  the  goals,  but  technology  exists  today  that  can  start  to  address  them.  This  technology  needs 
to  be  evaluated  in  light  of  what  it  can  deliver,  and  that  begins  by  addressing  the  reliability/complexity  issue. 

Intelligent  control  and  health  management  is  going  to  be  possible  with  software  and  more  powerful  FADECs. 
However,  as  systems  get  more  complex  the  software  will  also  tend  to  become  more  intricate.  Thus  it  is  imperative 
that  the  software  be  designed  and  implemented  simultaneously  with  the  engine  development,  that  the  software 
address  the  detailed  requirements  for  the  engine  performance  and  safety,  and  that  the  software  be  tested  both 
empirically  and  using  more  formal  methods  for  verification.  The  potential  contribution  of  technologies  to  overall 
VAATE  and  NASA  goals  needs  to  be  quantified,  and  the  integration  of  technologies  needs  to  be  investigated  and 
coordinated  in  order  to  achieve  the  highest  level  of  contribution  to  future  engines.  The  goals  will  not  be  reached 
through  algorithms  alone,  but  the  share  that  they  can  contribute  can  be  met  with  further  development  in  these  areas. 
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